Stepping Stone Detection for Tracing Attack Sources in Software-Defined Networks

Abstract: Stepping stones are compromised hosts in a network which can be used by hackers and other malicious attackers to hide the origin of connections. Attackers hop from one compromised host to another to form a chain of stepping stones before launching attack on the actual victim host. Various timing and content based detection techniques have been proposed in the literature to trace back through a chain of stepping stones in order to identify the attacker. This has naturally led to evasive strategies such as shaping the trac di erently at each hop. The evasive techniques can also be detected. Our study aims to adapt some of the existing stepping stone detection and antievasion techniques to software-dened networks which use network function virtualization. We have implemented the stepping-stone detection techniques in a simulated environment and use sFlow for the trac monitoring at the switches. We evaluate the detection algorithms on di erent network topologies and analyze the results to gain insight on the e ectiveness of the detection mechanisms. The selected detection techniques work well on relatively high packet sampling rates. However, new solutions will be needed for large SDN networks where the packet sampling rate needs to be lower.